Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Risk Fields #518

Closed
wants to merge 10 commits into from
Closed

Risk Fields #518

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
901fe02
Create risk.yml
dainperkins Aug 13, 2019
90cfad6
Risk Fields
dainperkins Aug 13, 2019
23f868b
Update CHANGELOG.next.md
dainperkins Aug 13, 2019
90c9b8d
Merge branch 'master' into risk
dainperkins Aug 13, 2019
0cb9528
updates to remove non local fields
dainperkins Aug 13, 2019
31f334f
Merge branch 'risk' of https://github.com/dainperkins/ecs into risk
dainperkins Aug 13, 2019
0922981
Update schema.json
dainperkins Aug 13, 2019
034ff6c
updated Risk Fields
dainperkins Aug 27, 2019
b8c3601
Risk updates - 12-8
dainperkins Dec 9, 2019
d7dc28c
updated Risk fields
dainperkins Dec 9, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions code/go/ecs/risk.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 11 additions & 0 deletions generated/legacy/template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,6 +701,17 @@
}
}
},
"risk": {
"properties": {
"label": {
"ignore_above": 1024,
"type": "keyword"
},
"score": {
"type": "long"
}
}
},
"server": {
"properties": {
"address": {
Expand Down
52 changes: 52 additions & 0 deletions schemas/risk.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
---
- name: risk
title: Group
group: 2
type: group
short: Risk Scores and Labels
description: >
Risk fields represent the normalized comparative sensitivity of internal resources or the potential risk of threats, vulnerabilities, and IOCs.

At the event level normalized risk is calculated based on any risk metrics available for lookup for the given event
(e.g. a user, source, destination in a firewall log, a client and file in a endpoint file/process log). The final event score
is calculated by summing the squares of each avaialble risk score and dividing by the total multiple of available scores.
As an example: ( user.risk + source.risk + destination.risk ) / ( user.risk + source.risk + destination.risk )

Risk labels are for labeling the type of business risk represented by a given resource, typically in reference to the data
housed in an asset or zone, the level of access of a given user or group, or the risk represented by a given threat or IOC.

reusable:
top_level: false
expected:
- event
- user
- group
- client
- source
- server
- destination
- cloud
- container
- network
- file
- threat
- vulnerbility


fields:

- name: label
level: extended
type: keyword
description: locally relevant label to describe the risk type of asset or data identified either
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we enhance this definition to make it clearer to those transforming data what they should put here? What is the relationship of this field value to the risk.score? Do we expect this to be an array, holding multiple values?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An array could be helpful, certainly I can see applying PCI & IAM or PCI & Security, etc.

specific to a local data classification system or regulatory/compliance applicability

example: public, private, confidential, PCI, CFR21p11, PII, SOX, GDPR

- name: score
level: extended
type: long
description: comparative risk score quantitavely scoring the level of risk of the asset or data,
or risk represented by a given threat (typically provided by )

example: 1-10
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really just an example, or should we define this must contain a 0-10 value? At the least, we should recommend a 0-10 scoring system.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think all the scores should be 0-10, matches all of the existing CVE/CVSS etc.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might help to consider how we would apply asset / resource risk levels to a normalized scoring system to prioritize signals by business risk - tho I suppose we could allow for multiples.